1. Use Passkey from 1Password
2. Profit
Passkeys were invented by engineers with zero understanding of consumer brain
711–720 of 813 posts
Re: Passkeys were invented by engineers with zero understanding of consumer brain
#712Earlier quoted context omitted.
Think of it like SSH authorized keys but automated for the web. Instead of storing the keys in a file; it stores them in a hardware security module (yubikey, or TPM). Registration generates an asymmetric key pair between your passkey, and the website. Login is the usual challenge/response process. The biggest step forward is phishing resistance. A fake login page can relay a TOTP code, but not the passkey challenge/r…
Yes, those are the easy parts - but none if that answers GP's questions: > If my passkey is on my phone what happens if I lose my phone? Do I need a unique passkey per device? How do I rotate them? What if a device gets stolen? I'd also add: How do I login on a device or browser that I've never logged in before? If I'm on a public computer that I trust enough for quickly logging into my emails but (say, the local lib…
There isn't one correct answer because all those things are implementation dependent. Passkeys just define how a website, browser and OS communicate logging you in between eachother. If someone in charge of making a website designs a bad login system on top of that you will get a bad experience.
> Do I need a unique passkey per device?
If you store it in the device itself (passkey isn't moveable) and not a password manager (you can move the passkey around) then yes.
> If my passkey is on my phone what happens if I lose my phone?
Delete the passkey using another device. If your phone is the only trusted device/only device that had a passkey, begin account recovery (e.g. via email).
> How do I rotate them? What if a device gets stolen?
You shouldn't need to, if they are properly stored in the device (in hardware) and not a password manager they should not be extractable. But if you lost your device/it got stolen and you have no lockscreen password you would need another device that also has a passkey that you would use to invalidate the other one from the account settings page similarly to how you would change your password (you are logged in with another passkey, that is your "existing password" in the password model and you don't set a new password but instead delete the other passkey and create a new one). If instead you use a password manager and it gets breached, either rush in to create a new passkey (e.g. on device temporarily) and then delete the old one, or if they got ahead of you begin account recovery, similarly to if your password got extracted from your password manager.
> How do I login on a device or browser that I've never logged in before?
Similar to steam and discord's Qr code login system if you've ever used that. Ideally when you visit the website would generate a login session and you could then login from a personal device you have on you by scanning a qr code or manually entering a code (for devices without a camera). Probably also tick a checkbox that you are logging in on a public device and that you only want a short lived session, but such a feature doesn't generally exist in login systems that use passwords either, even though it would be convenient to have.
---
All these answers above depend on the login system being well designed. If the people writing the website don't let you register multiple passkeys or don't make it convenient to register a new one whenever you login on a new device, or don't offer the aforementioned Qr code login system or don't offer good account recovery - you will have a bad experience.
Re: Passkeys were invented by engineers with zero understanding of consumer brain
#713It’s quite the opposite. Passkeys are phenomenal for a lot of consumers. Based on this thread, it’s the engineers who understand authentication in the first place and have their own system (eg password manager) that are confused. Consider a user in the Apple ecosystem: you are already conditioned to just do Touch ID or Face ID when asked. I was on Amazon the other day, it prompted randomly for “want to set up a passk…
Until you want to log in on a non-Apple device.
This is not true. There's a specced QR code and Bluetooth workflow for using a passkey on one device to sign into an account on another. It works cross-platform.
Re: Passkeys were invented by engineers with zero understanding of consumer brain
#714Earlier quoted context omitted.
Passkeys do *not* do that. I use 1Password to manage my passkeys and they are all synced across all my authenticated devices where I installed 1Password.
How do you move your passkey from Apple's keychain into the password manager?
in the ios password app you can tap on the button to export data to other app. it will show you the list of installed apps that can import them. works with passwords and passkeys.
I moved all of them from my iphone to a selfhosted bitwarden in two minutes.
Re: Passkeys were invented by engineers with zero understanding of consumer brain
#715Earlier quoted context omitted.
You don’t. You don’t store anything at all. On registration, a keypair is generated, then the private key is encrypted with the long-term key burned into your security key fob or hardware. The encrypted blob is sent to the server and stored there. On authentication, after you enter your login, the server sends the encrypted blob and your security key tries to decrypt it with the long-term key it has. If it succeeds,…
> You don’t. You don’t store anything at all. Yes, you do. Whenever a website offers to create a passkey, it could end up in any of these: - Samsung's Password Manager (if using a Samsung phone) - Apple's Keychain (if using an iPhone) - Google Password Manager - Your operating system's keychain - A bespoke password manager (e.g., Bitwarden or LastPass) - Your hardware key Most users do not have a security key fob. In…
I was talking about the non-resident FIDO keys. “Passkey” term is meaningless unfortunately because FIDO Alliance did not define it initially, it was a marketing term invented by Apple and then re-introduced (or shoved down the throat) by the FIDO alliance.
In non-resident keys scenario you don’t store anything and from what I see there is no security downside of using non-resident keys.
Loosing both (or multiple) security keys is like loosing all your car or home keys. Very inconvenient, agreed.
Anyway, I think we can agree that FIDO authentication protocol implementation is a mess. Apple and Google made it messy because they wanted to lock down users to their platforms and then password managers followed. As a result, the current implementation is not more secure than “login with Apple” or “login with Google”.
Re: Passkeys were invented by engineers with zero understanding of consumer brain
#716Earlier quoted context omitted.
My elderly mother accidentally created a passkey (in Chrome) for one of her accounts. Normally, I try to keep a copy of her accounts and passwords in case she forgets them so I can help her out. With the passkey, this is impossible. She doesn't know how she created one, she doesn't know what it is, and I don't know how to explain to her that if her PC dies I won't be able to help her log back into her account. I'm no…
Any decent password manager can handle all of those. Apple does. I’d expect the same of Chrome, Edge, Firefox and 1Password but don’t personally use any of them. Why not just set yourself up to be able to access her password vault? Why is copying magic strings a better solution? You could have done that to get password access without passkeys existing. So they change nothing.
If you are going to store passkeys in a password manager, the whole situation is no more secure than just using passwords.
Consider:
1. Password managers tie passwords to sites, so phishing-resistance is achieved. 2. Password managers allow long, complicated, individual password per web site, so compromise blast radius is 1.
Re: Passkeys were invented by engineers with zero understanding of consumer brain
#717Passkeys are a mitigation against users being bad at password hygiene and phishing being a real issue to users. You can't phish a passkey, and you don't rely on the user providing you 'hunter2' on every site. As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source…
> As for vendor lock in? No. The specs are open. You can run the code on a microcontroller, or, you can keep it in your arm with something like the Vivokey Apex. Note that the FIDO2 for the Apex is an open source Javacard applet. That is not true. Passkeys support device attestation, enabling websites to lock you out if you don't use their approved devices. Which is happening with all the big platforms right now.
Neither Apple nor Google do key attestation for their cloud-synced keys.
This
> Which is happening with all the big platforms right now.
Re: Passkeys were invented by engineers with zero understanding of consumer brain
#718Earlier quoted context omitted.
Yes, those are the easy parts - but none if that answers GP's questions: > If my passkey is on my phone what happens if I lose my phone? Do I need a unique passkey per device? How do I rotate them? What if a device gets stolen? I'd also add: How do I login on a device or browser that I've never logged in before? If I'm on a public computer that I trust enough for quickly logging into my emails but (say, the local lib…
There isn't one correct answer because all those things are implementation dependent. Passkeys just define how a website, browser and OS communicate logging you in between eachother. If someone in charge of making a website designs a bad login system on top of that you will get a bad experience. > Do I need a unique passkey per device? If you store it in the device itself (passkey isn't moveable) and not a password m…
> All these answers above depend on the login system being well designed. If the people writing the website don't let you register multiple passkeys or don't make it convenient to register a new one whenever you login on a new device, or don't offer the aforementioned Qr code login system or don't offer good account recovery - you will have a bad experience.
But this is one of the points being discussed here. All of depends on a large number of choices that each site owner will have to get right. You could always argue "well, it's the site's fault for not doing it better", but the matter is that the site owner has to decide those things at all - and if course they will make their own tradeoffs or simply don't bother with certain features.
So you will always have a wildly inconsistent mix of different functionalities and constraints depending on the preferences of the individual services.
Whereas with passwords, implementers don't have to do any of those choices, the basic implementation already supports all those usage scenarios.
The QR code login flow is one such example. I probably have some bias that I don't like the thought of making my phone the sole authority for all my accounts, but even if you accept that, it's an exotic technically complicated flow for the exclusive usecase of "login on untrusted device". There are probably few sites that weigh that usecase high enough to implement the flow - whereas with passwords, there is nothing you have to implement, because the functionality is just a natural consequence of how passwords work.
Re: Passkeys were invented by engineers with zero understanding of consumer brain
#719Earlier quoted context omitted.
How do you move your passkey from Apple's keychain into the password manager?
in the ios password app you can tap on the button to export data to other app. it will show you the list of installed apps that can import them. works with passwords and passkeys. I moved all of them from my iphone to a selfhosted bitwarden in two minutes.
Ok, good to know that.
I'm surprised selfhosted services would be allowed in that list. Isn't there the "risk" that you can then extract the raw key from your selfhosted instance?